Apache Openmeetings
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_openmeetings:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Openmeetings (0ceee963-f77b-51bf-977b-877251b0ee69) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-49488 |
vulnerable | 2026-07-29 00:57:45.479837 |
Apache OpenMeetings: Arbitrary File Read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings.
This issue affects Apache OpenMeetings: from 5.0.0 before 9.1.0.
An attacker with moderator rights in any room can read arbitrary files accessible to the OS account running the OM server, including credentials and secrets, via a crafted download request.
Users are recommended to upgrade to version 9.1.0, which fixes the issue.
Published: 2026-07-14T12:21:05.929Z
Updated: 2026-07-15T15:13:20.235Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34020 |
vulnerable | 2026-06-08 07:59:11.692694 |
Apache OpenMeetings: Login Credentials Passed via GET Query Parameters
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.
The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact
This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
Published: 2026-04-09T15:52:06.599Z
Updated: 2026-04-10T20:13:47.789Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33266 |
vulnerable | 2026-06-08 07:59:09.454418 |
Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt
Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.
The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.
This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
Published: 2026-04-09T15:52:36.105Z
Updated: 2026-04-10T18:49:13.351Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33005 |
vulnerable | 2026-06-08 07:57:18.449564 |
Apache OpenMeetings: Insufficient checks in FileWebService
Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.
Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.
This issue affects Apache OpenMeetings: from 3.10 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
Published: 2026-04-09T15:52:50.770Z
Updated: 2026-04-10T18:44:45.976Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-54676 |
vulnerable | 2026-06-08 06:54:16.748509 |
Apache OpenMeetings: Deserialisation of untrusted data in cluster mode
Vendor: The Apache Software Foundation
Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0
Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data.
Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.
Published: 2025-01-08T08:40:03.705Z
Updated: 2025-01-08T14:00:52.923Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29246 |
vulnerable | 2026-06-08 06:02:39.191991 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29032 |
vulnerable | 2026-06-08 06:02:37.959137 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28936 |
vulnerable | 2026-06-08 06:02:36.661129 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28326 |
vulnerable | 2026-06-08 06:01:10.357070 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-27576 |
vulnerable | 2026-06-08 05:31:21.794166 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1286 |
vulnerable | 2026-06-08 05:11:17.479770 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7688 |
vulnerable | 2026-06-08 05:10:05.895517 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7685 |
vulnerable | 2026-06-08 05:10:05.870390 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7684 |
vulnerable | 2026-06-08 05:10:05.869389 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7683 |
vulnerable | 2026-06-08 05:10:05.868209 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7682 |
vulnerable | 2026-06-08 05:10:05.867693 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7681 |
vulnerable | 2026-06-08 05:10:05.867040 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7680 |
vulnerable | 2026-06-08 05:10:05.865930 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7673 |
vulnerable | 2026-06-08 05:10:05.783262 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7666 |
vulnerable | 2026-06-08 05:10:05.733648 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7664 |
vulnerable | 2026-06-08 05:10:05.724263 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7663 |
vulnerable | 2026-06-08 05:10:05.722385 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-8736 |
vulnerable | 2026-06-08 05:08:14.746117 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.